@oneuptime/common 12.0.5 → 12.0.7

package/build/dist/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.js

@@ -16,6 +16,7 @@ import WorkspaceType from "../../../../Types/Workspace/WorkspaceType";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 import WorkspaceProjectAuthTokenService from "../../../Services/WorkspaceProjectAuthTokenService";
+import SSRFProtection from "../../SSRFProtection";
 import OneUptimeDate from "../../../../Types/Date";
 import { MicrosoftTeamsAppClientId, MicrosoftTeamsAppClientSecret, MicrosoftTeamsAppTenantId, } from "../../../EnvironmentConfig";
 // Import services for bot commands
@@ -43,8 +44,26 @@ import MicrosoftTeamsOnCallDutyActions from "./Actions/OnCallDutyPolicy";
 import AccessTokenService from "../../../Services/AccessTokenService";
 // Microsoft Teams apps should always be single-tenant
 const MICROSOFT_TEAMS_APP_TYPE = "SingleTenant";
+/*
+ * Microsoft's wording when the Bot Framework refuses a proactive post because
+ * the app is not a member of the target conversation. Matched case-insensitively
+ * so we can replace it with something the admin can act on.
+ */
+const MICROSOFT_TEAMS_ROSTER_ERROR_FRAGMENTS = [
+    "not part of the conversation roster",
+    "bot is not part of the conversation",
+];
 // Maximum number of pages to fetch when paginating teams
 const MICROSOFT_TEAMS_MAX_PAGES = 500;
+/*
+ * Hosts that may receive a Teams incoming webhook. Connector webhooks are
+ * issued on outlook.office.com / outlook.office365.com, and per-tenant ones on
+ * <tenant>.webhook.office.com — all covered by these two registrable domains.
+ */
+export const MICROSOFT_TEAMS_WEBHOOK_DOMAINS = [
+    "office.com",
+    "office365.com",
+];
 class MicrosoftTeamsUtil extends WorkspaceBase {
     // Get or create Bot Framework adapter for a specific tenant
     static getBotAdapter() {
@@ -463,11 +482,26 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
     static async sendMessageToChannelViaIncomingWebhook(data) {
         logger.debug("Sending message to Teams channel via incoming webhook:");
         logger.debug(data);
+        /*
+         * Enforced at the sink, not only at the callers: this URL reaches here from
+         * workflow arguments and from status page subscribers, and a caller that
+         * forgets the pin is an SSRF from the API server.
+         */
+        if (!MicrosoftTeamsUtil.isValidMicrosoftTeamsIncomingWebhookUrl(data.url)) {
+            throw new BadDataException(`Microsoft Teams Webhook URL must be an https URL on ${MICROSOFT_TEAMS_WEBHOOK_DOMAINS.join(" or ")}.`);
+        }
         // Build a structured MessageCard from markdown for better rendering in Teams
         const payload = this.buildMessageCardFromMarkdown(data.text);
         const apiResult = await API.post({
             url: data.url,
             data: payload,
+            options: {
+                /*
+                 * The host is pinned to Microsoft, but do not let a redirect from it
+                 * bounce this request to an internal address.
+                 */
+                doNotFollowRedirects: true,
+            },
         });
         if (!apiResult) {
             logger.error("Could not send message to Teams channel via incoming webhook.");
@@ -483,10 +517,14 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
         return apiResult;
     }
     static isValidMicrosoftTeamsIncomingWebhookUrl(incomingWebhookUrl) {
-        // Check if the URL contains outlook.office.com or office.com webhook pattern
-        const urlString = incomingWebhookUrl.toString();
-        return (urlString.includes("outlook.office.com") ||
-            urlString.includes("office.com"));
+        /*
+         * Pin on the URL's HOST, not on a substring of the whole URL. Subscribers
+         * (including unauthenticated ones on a public status page) supply this
+         * value and the server POSTs to it, so a substring check was satisfied by
+         * an attacker-controlled path or query — `http://169.254.169.254/?x=office.com`
+         * passed and turned this into an SSRF into the cloud metadata endpoint.
+         */
+        return SSRFProtection.isUrlOnAllowedDomain(incomingWebhookUrl, MICROSOFT_TEAMS_WEBHOOK_DOMAINS);
     }
     static async getUsernameFromUserId(data) {
         logger.debug("Getting username from user ID with data:", {
@@ -697,6 +735,7 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                     name: displayName,
                     workspaceType: WorkspaceType.MicrosoftTeams,
                     teamId: data.teamId,
+                    membershipType: channelData["membershipType"],
                 };
                 logger.debug(`Channel match found: ${JSON.stringify(foundChannel)}`);
                 return foundChannel;
@@ -736,6 +775,16 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
         const workspaceChannelsToPostTo = [];
         logger.debug(`Processing ${data.workspaceMessagePayload.channelNames.length} channel names`);
         logger.debug(`Channel names: ${JSON.stringify(data.workspaceMessagePayload.channelNames)}`);
+        /*
+         * Declared before destination resolution so that a destination we cannot
+         * even resolve is reported as an error. Silently skipping it made a
+         * typo'd or deleted channel look like a successful send.
+         */
+        const workspaceMessageResponse = {
+            threads: [],
+            workspaceType: WorkspaceType.MicrosoftTeams,
+            errors: [],
+        };
         // Resolve channel names
         for (const channelName of data.workspaceMessagePayload.channelNames) {
             logger.debug(`Attempting to resolve channel name: ${channelName}`);
@@ -754,6 +803,15 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
             }
             else {
                 logger.warn(`Channel not found: ${channelName}`);
+                workspaceMessageResponse.errors.push({
+                    channel: {
+                        id: "",
+                        name: channelName,
+                        workspaceType: WorkspaceType.MicrosoftTeams,
+                        teamId: data.workspaceMessagePayload.teamId,
+                    },
+                    error: `Channel "${channelName}" was not found in this Microsoft Teams team. It may have been renamed or deleted.`,
+                });
             }
         }
         logger.debug("=== Starting message sending loop ===");
@@ -781,16 +839,20 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                     channelId: channelId,
                 });
                 logger.error(err);
+                workspaceMessageResponse.errors.push({
+                    channel: {
+                        id: channelId,
+                        name: channelId,
+                        workspaceType: WorkspaceType.MicrosoftTeams,
+                        teamId: data.workspaceMessagePayload.teamId,
+                    },
+                    error: err instanceof Error ? err.message : String(err),
+                });
             }
         }
         logger.debug("=== Starting message sending loop ===");
         logger.debug(`Total channels to post to: ${workspaceChannelsToPostTo.length}`);
         logger.debug(`Channels: ${JSON.stringify(workspaceChannelsToPostTo)}`);
-        const workspaceMessageResponse = {
-            threads: [],
-            workspaceType: WorkspaceType.MicrosoftTeams,
-            errors: [],
-        };
         for (const channel of workspaceChannelsToPostTo) {
             try {
                 logger.debug(`Attempting to send message to channel: ${JSON.stringify(channel)}`);
@@ -915,6 +977,34 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 throw new BadDataException("Microsoft Teams App Client ID not configured");
             }
             logger.debug(`Using bot ID: ${miscData.botId}`);
+            /*
+             * Bots cannot post to shared channels at all, so fail with the reason
+             * rather than letting Microsoft reject the send with a generic error.
+             */
+            if (data.workspaceChannel.membershipType === "shared") {
+                throw new BadDataException(`"${data.workspaceChannel.name}" is a shared channel, and Microsoft Teams does not allow bots to post in shared channels. Please pick a standard or private channel instead.`);
+            }
+            /*
+             * Preflight: refuse before calling the Bot Framework when we know the
+             * app was never installed into this team. Channels are discovered with
+             * tenant-wide Graph application permissions, which see every team
+             * regardless of installation — so reaching this point proves nothing
+             * about whether we can actually post.
+             *
+             * installedTeams is only populated from install events, so an empty map
+             * means "we have not observed any installs" (for example on a workspace
+             * connected before this shipped), not "nothing is installed". Only
+             * enforce once we have at least one record, and let the Bot Framework
+             * error be translated below otherwise.
+             */
+            const installedTeams = miscData.installedTeams || {};
+            const installedTeam = installedTeams[data.teamId];
+            if (Object.keys(installedTeams).length > 0 && !installedTeam) {
+                throw new BadDataException(this.getBotNotInTeamMessage({
+                    channelName: data.workspaceChannel.name,
+                    membershipType: data.workspaceChannel.membershipType,
+                }));
+            }
             // Get Bot Framework adapter
             const adapter = this.getBotAdapter();
             // Create conversation reference for the channel
@@ -931,7 +1021,12 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                     tenantId: tenantId,
                 },
                 channelId: "msteams",
-                serviceUrl: "https://smba.trafficmanager.net/teams/",
+                /*
+                 * Fallback is the commercial-cloud global endpoint; the serviceUrl
+                 * captured from the install event is preferred (required for GCC/DoD),
+                 * matching what sendAdaptiveCardToChat already does.
+                 */
+                serviceUrl: (installedTeam === null || installedTeam === void 0 ? void 0 : installedTeam.serviceUrl) || "https://smba.trafficmanager.net/teams/",
             };
             logger.debug(`Conversation reference: ${JSON.stringify(conversationReference)}`);
             // Send proactive message using Bot Framework
@@ -961,9 +1056,44 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 teamId: data.teamId,
             });
             logger.error(error);
+            /*
+             * Microsoft's roster rejection is meaningless to an admin ("The bot is
+             * not part of the conversation roster"). Replace it with the action that
+             * actually fixes it.
+             */
+            if (this.isBotNotInConversationRosterError(error)) {
+                throw new BadDataException(this.getBotNotInTeamMessage({
+                    channelName: data.workspaceChannel.name,
+                    membershipType: data.workspaceChannel.membershipType,
+                }));
+            }
             throw error;
         }
     }
+    /*
+     * True when an error is Microsoft's "bot is not in this conversation"
+     * rejection from a proactive Bot Framework send.
+     */
+    static isBotNotInConversationRosterError(error) {
+        const message = (error instanceof Error ? error.message : String(error || "")).toLowerCase();
+        if (!message) {
+            return false;
+        }
+        return MICROSOFT_TEAMS_ROSTER_ERROR_FRAGMENTS.some((fragment) => {
+            return message.includes(fragment);
+        });
+    }
+    /*
+     * Actionable replacement for the roster error. Private channels need the app
+     * installed into the channel itself; a parent-team install does not cover
+     * them, so the two cases get different instructions.
+     */
+    static getBotNotInTeamMessage(data) {
+        if (data.membershipType === "private") {
+            return `The OneUptime app is not installed in the private channel "${data.channelName}". In Microsoft Teams, open the channel, click the "..." menu, then Manage channel > Apps > Add an app, and add OneUptime. Installing OneUptime in the parent team does not cover private channels.`;
+        }
+        return `The OneUptime app is not installed in the Microsoft Teams team that owns "${data.channelName}". In Microsoft Teams, click the "..." next to the team name, then Manage team > Apps > More apps, and add OneUptime. Installing OneUptime for yourself or in a chat is not the same as adding it to the team.`;
+    }
     /*
      * Sends an adaptive card to a Teams group chat or personal (1:1) chat via a
      * proactive Bot Framework message. The OneUptime app must have been added to
@@ -1109,6 +1239,7 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 name: channelData["displayName"],
                 workspaceType: WorkspaceType.MicrosoftTeams,
                 teamId: data.teamId,
+                membershipType: channelData["membershipType"],
             };
             logger.debug(`Channel info retrieved: ${JSON.stringify(channel)}`);
             return channel;
@@ -1251,10 +1382,21 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
         const channelsArray = channelsData["value"] || [];
         const channelsDict = {};
         for (const channelData of channelsArray) {
+            const membershipType = channelData["membershipType"];
+            /*
+             * Microsoft Teams does not support bots in shared channels, so offering
+             * one as a notification destination can only ever produce a failed send.
+             */
+            if (membershipType === "shared") {
+                logger.debug(`Skipping shared channel ${channelData["displayName"]} — Teams does not support bots in shared channels.`);
+                continue;
+            }
             const channel = {
                 id: channelData["id"],
                 name: channelData["displayName"],
                 workspaceType: WorkspaceType.MicrosoftTeams,
+                teamId: data.teamId,
+                membershipType: membershipType,
             };
             channelsDict[channel.id] = channel;
         }
@@ -1410,6 +1552,18 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
                 onlyIfMissingOrStale: true,
             });
         }
+        /*
+         * Same backfill for team installs. Teams the app was added to before we
+         * started recording installs fire no new install event, so an @mention in
+         * any channel of that team is the recovery path that makes proactive
+         * channel notifications work again.
+         */
+        if (messageConversationType === "channel") {
+            await this.captureTeamFromBotActivity({
+                activity: data.activity,
+                turnContext: data.turnContext,
+            });
+        }
         // If this is actually an Adaptive Card submit wrapped as a message, route to invoke handler
         if (possibleActionValue["action"] ||
             ((_b = possibleActionValue["data"]) === null || _b === void 0 ? void 0 : _b["action"])) {
@@ -1442,27 +1596,15 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
             return;
         }
         // Get project auth by tenant ID
-        const projectAuth = await WorkspaceProjectAuthTokenService.findOneBy({
-            query: {
-                workspaceType: WorkspaceType.MicrosoftTeams,
-                workspaceProjectId: tenantId,
-            },
-            select: {
-                projectId: true,
-                workspaceProjectId: true,
-            },
-            props: {
-                isRoot: true,
-            },
+        const tenantResolution = await this.resolveProjectByTenantId({
+            tenantId: tenantId,
         });
-        if (!projectAuth || !projectAuth.projectId) {
-            logger.error("Project auth not found for tenant ID: " + tenantId, {
-                tenantId: tenantId,
-            });
-            await data.turnContext.sendActivity("Sorry, I couldn't find your project configuration. Please try again later.");
+        if (!tenantResolution.projectAuth ||
+            !tenantResolution.projectAuth.projectId) {
+            await data.turnContext.sendActivity(this.getTenantResolutionFailureMessage(tenantResolution));
             return;
         }
-        const projectId = projectAuth.projectId;
+        const projectId = tenantResolution.projectAuth.projectId;
         logger.debug(`Found project ID: ${projectId.toString()} for tenant ID: ${tenantId}`);
         // Clean the message text by removing bot mentions
         const cleanText = messageText
@@ -2253,26 +2395,15 @@ All monitoring checks are passing normally.`;
                 await data.turnContext.sendActivity("Sorry, I couldn't identify your organization. Please try again later.");
                 return;
             }
-            const projectAuth = await WorkspaceProjectAuthTokenService.findOneBy({
-                query: {
-                    workspaceType: WorkspaceType.MicrosoftTeams,
-                    workspaceProjectId: tenantId,
-                },
-                select: {
-                    projectId: true,
-                    authToken: true,
-                    workspaceProjectId: true,
-                },
-                props: { isRoot: true },
+            const tenantResolution = await this.resolveProjectByTenantId({
+                tenantId: tenantId,
             });
-            if (!projectAuth || !projectAuth.projectId) {
-                logger.error("Project auth not found for invoke activity tenant: " + tenantId, {
-                    tenantId: tenantId,
-                });
-                await data.turnContext.sendActivity("Sorry, I couldn't find your project configuration.");
+            if (!tenantResolution.projectAuth ||
+                !tenantResolution.projectAuth.projectId) {
+                await data.turnContext.sendActivity(this.getTenantResolutionFailureMessage(tenantResolution));
                 return;
             }
-            const projectId = projectAuth.projectId;
+            const projectId = tenantResolution.projectAuth.projectId;
             const fromObj = (data.activity["from"] ||
                 {});
             const teamsUserId = fromObj["aadObjectId"] || undefined;
@@ -2402,6 +2533,10 @@ All monitoring checks are passing normally.`;
                 activity: data.activity,
                 turnContext: data.turnContext,
             });
+            await this.captureTeamFromBotActivity({
+                activity: data.activity,
+                turnContext: data.turnContext,
+            });
             await this.sendWelcomeAdaptiveCard(data.turnContext);
         }
         if (botWasRemoved) {
@@ -2409,6 +2544,9 @@ All monitoring checks are passing normally.`;
             await this.removeChatFromBotActivity({
                 activity: data.activity,
             });
+            await this.removeTeamFromBotActivity({
+                activity: data.activity,
+            });
         }
     }
     static async handleInstallationUpdateActivity(data) {
@@ -2430,13 +2568,115 @@ All monitoring checks are passing normally.`;
                 activity: data.activity,
                 turnContext: data.turnContext,
             });
+            await this.captureTeamFromBotActivity({
+                activity: data.activity,
+                turnContext: data.turnContext,
+            });
         }
         else if (action === "remove" || action === "remove-upgrade") {
             logger.debug("OneUptime bot was uninstalled");
             await this.removeChatFromBotActivity({
                 activity: data.activity,
             });
+            await this.removeTeamFromBotActivity({
+                activity: data.activity,
+            });
+        }
+    }
+    /*
+     * Resolve the OneUptime project that owns a Microsoft tenant.
+     *
+     * Bot activities carry a tenant id and nothing else, so the tenant is the
+     * only key we can resolve a project by. A tenant may legitimately be
+     * connected to more than one OneUptime project (saveChatToProjectAuthTokens
+     * fans out for exactly that reason), and when that happens the tenant alone
+     * does NOT identify a project.
+     *
+     * Previously this was a bare findOneBy, which silently returned whichever
+     * row sorted first and served that project's incidents, alerts and AI
+     * assistant answers to anyone in the tenant — including users with no access
+     * to it. The bot's message path performs no per-user authorization, so
+     * picking arbitrarily is a cross-project disclosure. Refuse instead.
+     */
+    static async resolveProjectByTenantId(data) {
+        const projectAuths = await WorkspaceProjectAuthTokenService.findBy({
+            query: {
+                workspaceType: WorkspaceType.MicrosoftTeams,
+                workspaceProjectId: data.tenantId,
+            },
+            select: {
+                projectId: true,
+                authToken: true,
+                workspaceProjectId: true,
+                miscData: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        /*
+         * Ambiguity is about distinct PROJECTS, not rows. Two rows pointing at the
+         * same project are a data-integrity wart, not a question we cannot answer,
+         * so collapse them rather than refusing to serve that tenant forever.
+         */
+        const seenProjectIds = new Set();
+        const usableProjectAuths = [];
+        for (const projectAuth of projectAuths) {
+            if (!projectAuth.projectId) {
+                continue;
+            }
+            const projectIdString = projectAuth.projectId.toString();
+            if (seenProjectIds.has(projectIdString)) {
+                continue;
+            }
+            seenProjectIds.add(projectIdString);
+            usableProjectAuths.push(projectAuth);
+        }
+        if (usableProjectAuths.length === 0) {
+            logger.error("Project auth not found for tenant ID: " + data.tenantId, {
+                tenantId: data.tenantId,
+            });
+            return {
+                projectAuth: null,
+                isAmbiguous: false,
+                candidateProjectIds: [],
+            };
+        }
+        if (usableProjectAuths.length > 1) {
+            const candidateProjectIds = usableProjectAuths.map((projectAuth) => {
+                return projectAuth.projectId;
+            });
+            logger.error(`Microsoft tenant ${data.tenantId} is connected to ${usableProjectAuths.length} OneUptime projects. Refusing to guess which one this bot activity belongs to.`, {
+                tenantId: data.tenantId,
+                projectIds: candidateProjectIds
+                    .map((projectId) => {
+                    return projectId.toString();
+                })
+                    .join(", "),
+            });
+            return {
+                projectAuth: null,
+                isAmbiguous: true,
+                candidateProjectIds: candidateProjectIds,
+            };
+        }
+        return {
+            projectAuth: usableProjectAuths[0],
+            isAmbiguous: false,
+            candidateProjectIds: [usableProjectAuths[0].projectId],
+        };
+    }
+    /*
+     * User-facing text for a failed tenant resolution. The two cases need
+     * different remedies, so they must not share a message.
+     */
+    static getTenantResolutionFailureMessage(resolution) {
+        if (resolution.isAmbiguous) {
+            return "This Microsoft 365 organization is connected to more than one OneUptime project, so I can't tell which one you mean. Please ask your OneUptime admin to disconnect Microsoft Teams from all but one project.";
         }
+        return "Sorry, I couldn't find your project configuration. This usually means the Microsoft 365 organization you're messaging me from isn't the one connected to OneUptime. Please ask your OneUptime admin to check the Microsoft Teams integration in Project Settings.";
     }
     /*
      * Chats (group chats and personal 1:1 chats) cannot be listed with the
@@ -2713,6 +2953,148 @@ All monitoring checks are passing normally.`;
         }
         return (projectAuth.miscData.availableChats || {});
     }
+    /*
+     * Record that the OneUptime app was installed into a team.
+     *
+     * Team installs arrive as conversationUpdate / installationUpdate activities
+     * whose conversation is a channel. captureChatFromBotActivity drops those
+     * (channels are not chats), so before this existed we threw away the only
+     * signal that tells us a proactive channel post will be accepted.
+     */
+    static async captureTeamFromBotActivity(data) {
+        var _a;
+        try {
+            const channelData = data.activity["channelData"] || {};
+            const team = channelData["team"];
+            const teamId = (team === null || team === void 0 ? void 0 : team["id"]) || "";
+            if (!teamId) {
+                // Not a team-scoped activity (personal or group chat). Nothing to do.
+                return;
+            }
+            const tenantId = ((_a = channelData["tenant"]) === null || _a === void 0 ? void 0 : _a["id"]) || "";
+            if (!tenantId) {
+                logger.debug("No tenant id found on team activity. Skipping.");
+                return;
+            }
+            const installedTeam = {
+                id: teamId,
+                name: (team === null || team === void 0 ? void 0 : team["name"]) || undefined,
+                serviceUrl: data.activity["serviceUrl"] ||
+                    data.turnContext.activity.serviceUrl ||
+                    undefined,
+                addedAt: OneUptimeDate.getCurrentDate().toISOString(),
+            };
+            await this.saveTeamToProjectAuthTokens({
+                tenantId: tenantId,
+                team: installedTeam,
+            });
+            logger.debug(`Captured Microsoft Teams team install ${teamId} for tenant ${tenantId}`);
+        }
+        catch (err) {
+            logger.error("Error capturing Microsoft Teams team from bot activity:");
+            logger.error(err);
+        }
+    }
+    static async removeTeamFromBotActivity(data) {
+        var _a, _b;
+        try {
+            const channelData = data.activity["channelData"] || {};
+            const teamId = ((_a = channelData["team"]) === null || _a === void 0 ? void 0 : _a["id"]) || "";
+            const tenantId = ((_b = channelData["tenant"]) === null || _b === void 0 ? void 0 : _b["id"]) || "";
+            if (!teamId || !tenantId) {
+                return;
+            }
+            await this.removeTeamFromProjectAuthTokens({
+                tenantId: tenantId,
+                teamId: teamId,
+            });
+            logger.debug(`Removed Microsoft Teams team install ${teamId} for tenant ${tenantId}`);
+        }
+        catch (err) {
+            logger.error("Error removing Microsoft Teams team from bot activity:");
+            logger.error(err);
+        }
+    }
+    static async saveTeamToProjectAuthTokens(data) {
+        /*
+         * Same fan-out reasoning as saveChatToProjectAuthTokens: the install event
+         * does not say which project it belongs to, so record it on every project
+         * connected to this tenant.
+         */
+        const projectAuths = await WorkspaceProjectAuthTokenService.findBy({
+            query: {
+                workspaceType: WorkspaceType.MicrosoftTeams,
+                workspaceProjectId: data.tenantId,
+            },
+            select: {
+                _id: true,
+                miscData: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        for (const projectAuth of projectAuths) {
+            const miscData = Object.assign({}, (projectAuth.miscData || {}));
+            miscData.installedTeams = Object.assign(Object.assign({}, (miscData.installedTeams || {})), { [data.team.id]: data.team });
+            await WorkspaceProjectAuthTokenService.updateOneById({
+                id: projectAuth.id,
+                data: {
+                    miscData: miscData,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+        }
+    }
+    static async removeTeamFromProjectAuthTokens(data) {
+        const projectAuths = await WorkspaceProjectAuthTokenService.findBy({
+            query: {
+                workspaceType: WorkspaceType.MicrosoftTeams,
+                workspaceProjectId: data.tenantId,
+            },
+            select: {
+                _id: true,
+                miscData: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        for (const projectAuth of projectAuths) {
+            const miscData = Object.assign({}, (projectAuth.miscData || {}));
+            if (!miscData.installedTeams || !miscData.installedTeams[data.teamId]) {
+                continue;
+            }
+            const installedTeams = Object.assign({}, miscData.installedTeams);
+            delete installedTeams[data.teamId];
+            miscData.installedTeams = installedTeams;
+            await WorkspaceProjectAuthTokenService.updateOneById({
+                id: projectAuth.id,
+                data: {
+                    miscData: miscData,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+        }
+    }
+    static async getInstalledTeamsForProject(data) {
+        const projectAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
+            projectId: data.projectId,
+            workspaceType: WorkspaceType.MicrosoftTeams,
+        });
+        if (!projectAuth || !projectAuth.miscData) {
+            return {};
+        }
+        return (projectAuth.miscData.installedTeams || {});
+    }
     /**
      * Process Bot Framework activity using the botbuilder SDK adapter.processActivity
      * This replaces the manual JWT validation and activity handling with proper SDK methods
@@ -3045,7 +3427,12 @@ All monitoring checks are passing normally.`;
                     id: t["id"],
                     name: t["displayName"] || "Unnamed Team",
                 };
-                acc[team.name] = team;
+                /*
+                 * Keyed by id, not display name — Teams allows duplicate team
+                 * names, and keying by name silently collapsed them so only the
+                 * last one of each name was selectable.
+                 */
+                acc[team.id] = team;
                 return acc;
             }, {});
             logger.debug(`Processed ${Object.keys(availableTeams).length} teams`);
@@ -3510,6 +3897,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], MicrosoftTeamsUtil, "handleInstallationUpdateActivity", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "resolveProjectByTenantId", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
@@ -3540,6 +3933,36 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], MicrosoftTeamsUtil, "getChatsForProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "captureTeamFromBotActivity", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "removeTeamFromBotActivity", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "saveTeamToProjectAuthTokens", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "removeTeamFromProjectAuthTokens", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "getInstalledTeamsForProject", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),